Wireshark · Wireshark-users: Re: [Wireshark-users] Query regarding Wireshark

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Martin Visser wrote:
> Hmmm, obviously even on a multi-core machine the network drivers must be 
> able to present packets to the OS network stack in the order on the 
> wire. What mechanism allows libpcap to do thing in a different order. If 
> what you are saying is correct, that has to be a major issue in libpcap?

Modern Solaris drivers are pretty aggressive about using multiple DMA 
channels to parallelize transfers to/from their NICs.  It's probably the 
only way to saturate a 10-G NIC with their (numerous but) slow SPARC 
CPUs, but it can cause nightmares for software that was designed back 
when (e.g., UDP) packets rarely got out of order.